Crypto Hack Losses Driven by a Handful of Major Exploits: Immunefi

A new security report from Immunefi finds that crypto hacks continue at a steady pace while losses are becoming more concentrated in a small number of massive exploits.

Analyzing 425 publicly known incidents between 2021 and 2025, the report estimates that the average hack now results in about $25 million in stolen funds. In 2024 and 2025 alone, 191 hacks led to $4.67 billion in losses, with just five incidents accounting for 62% of the total.

Despite representing fewer incidents, centralized exchange breaches drove the majority of losses. Twenty exchange hacks accounted for roughly $2.55 billion, or about 55% of the total, reflecting how large pools of user funds are concentrated behind fewer points of failure.

Token markets also appear to be reacting more harshly to breaches. Across 82 hacked tokens tracked in the study, prices fell a median 61% within six months, with 83.9% remaining below their hack-day price over that period.

“The market has become less forgiving because expectations have changed,” Immunefi CEO Mitchell Amador told Cointelegraph, adding that breaches are now seen as signals of deeper issues in engineering, governance and operational resilience.

Amador said the long-term impact of exploits often extends well beyond the initial loss:

The stolen funds are only the first layer of damage. What follows is often more destructive: sustained token price suppression, reduced treasury capacity, leadership disruption, lost development time, and erosion of user trust.

The report also highlighted how interconnected DeFi systems can amplify the fallout from a single incident, with failures cascading across lending, collateral and liquidity networks.

One example involved the collapse of Elixir’s deUSD stablecoin in November 2025. Elixir had parked roughly 65% of deUSD’s collateral with Stream Finance, which disclosed a $93 million loss from an external fund manager. As Stream’s stablecoin xUSD fell 77%, deUSD’s backing deteriorated, redemptions halted and panic selling hit Curve pools, ultimately pushing deUSD down more than 97%.

Related: South Korea sells $21.5M in recovered Bitcoin after custody breach

Recent exploits highlight ongoing security risks in crypto

While crypto-related hack losses fell to $26.5 million in February, the lowest monthly total in nearly a year, according to PeckShield, several security incidents have already surfaced in March.

Researchers at Google reported a new exploit kit targeting Apple iPhone users that is designed to steal cryptocurrency wallet seed phrases. The toolkit, known as Coruna, contains multiple exploit chains capable of targeting devices running various versions of Apple’s iOS and has been linked to phishing websites posing as crypto platforms.